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FOREWORD 


This  publication  has  been  prepared  for  executives  and 
managers  who  depend  on  ADP  resources  and  services  to 
accomplish  the  organizational  objectives  for  which  they  are 
responsible.  The  goal  is  to  help  in  understanding  the  need 
for  Automatic  Data  Processing  (ADP)  contingency  planning, 
to  specify  management's  scope  of  involvement,  to  indicate 
in  summary  form  the  contents  of  ADP  contingency  plans 
and  how  one  proceeds  in  developing  such  plans. 

There  are,  indeed,  many  existing  methods  and  procedures 
concerning  contingency  planning,  each  of  which  may  be 
adequate  when  used  for  the  specific  purposes  intended  by 
the  authors.  The  process  shown  in  this  document  is  based 
on  the  method  described  in  Federal  Information  Processing 
Standards  Publication  (FIPS  PUB)  87,  Guidelines  for  ADP 
Contingency  Planning  [6].  The  primary  intended  audience 
of  FIPS  PL'B  87  comprises  line  managers  and  others  within 
the  Federal  data  processing  community  who  are  specifically 
responsible  for  .\DP  resources.  The  material  herein  has 
been  made  sufficiently  general  in  nature  so  as  to  be  useful 
to  all  managers  throughout  the  organizational  structure 
engaged  in  any  activity  which  receives  .^DP  support. 

This  document  is  part  of  a  continuing  series  of  publications 
on  the  subject  of  computer  security  prepared  by  the 
Institute  for  Gjmputer  Sciences  and  Technology. 
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ABSTRACT 


This  document  provides,  in  the  form  of  questions  and 
answers,  the  background  and  basic  essential  information 
required  to  understand  the  developmental  process  for  Auto- 
matic Data  Processing  (ADP)  contingency  plans.  The 
primary  intended  audience  consists  of  executives  and 
managers  who  depend  on  ADP  resources  and  services,  yet 
may  not  be  directly  responsible  for  the  daily  management 
or  supervision  of  data  processing  activities  or  facilities.  The 
publication  should  also  be  especially  beneficial  to  individu- 
als responsible  for  ensuring  compliance  with  Office  of  Man- 
agement and  Budget  Circular  A-71,  Transmittal  Memoran- 
dum Number  1,  July  27,  1978. 

Key  words:  ADP  security;  backup  operations;  computer 
security;  contingency  planning;  emergency  response; 
Federal  Information  Processing  Standards  Publication; 
recovery  actions. 
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BASIC  TERMS 

Backup  operation  is  a  method  for  accomplishing 
essential  tasks  subsequent  to  disruption  of  the  ADP  facility 
and  for  continuing  operations  until  the  facility  is  sufficient- 
ly restored. 

Computer  security  refers  to  the  technological  safeguards 
and  managerial  procedures  which  can  be  applied  to 
computer  hardware,  programs,  data  and  facilities  to  assure 
the  availability,  integrity'  and  confidentiality  of  computer 
based  resources  and  to  assure  that  intended  functions  are 
performed  without  harmful  side  effects. 

Critical  functions,  systems,  and  resources  are  those 
without  which  the  organization  cannot  continue  to  operate, 
or  even  survive. 

Emergency  response  is  the  immediate  action  taken  upon 
occurrence  of  events  such  as  natural  disasters,  fire,  civil  dis- 
ruption, and  bomb  threats  in  order  to  protect  lives,  limit 
the  damage  to  property,  and  minimize  the  impact  on  ADP 
operations. 

Recovery  consists  of  the  restoration  of  the  ADP  facility  or 
other  related  assets  following  physical  destruction  or  major 
damage. 

Risk  analysis  is  an  evaluation  of  the  threats  to  and  the 
loss  potential  of  an  ADP  facility  leading  to  an  estimate  of 
annual  loss.  Risk  analysis  results  are  used  in  the  selection 
of  cost  effective  remedial  measures. 
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WHY  ADP  CONTINGENCY  PLANNING 


1.  What  ie  contingency  planning? 

Contingency  planning  is  an  accepted  and  recommended 
management  practice  which  provides  for  well  thought  out 
responses  either  to  preclude  or,  at  least,  to  mitigate  the 
harmful  effects  of  potential  disruptive  events.  Prior  to 
preparing  contingency  plans  for  data  processing  activities,  it 
is  necessary  to  perform  a  risk  analysis  to  determine  the 
critical  ADP  systems  and  to  weigh  the  threats  and  vulnera- 
bilities as  they  relate  to  the  organization.  Potential  emergen-, 
cy  situations  can  then  be  anticipated,  strategies  for  coping 
with  them  can  be  developed,  and  finally,  a  predetermina- 
tion of  expected  responses  to  each  type  of  emergency  can 
be  made.  Contingency  planning  should,  of  course,  include 
the  actions  which  must  be  taken  in  response  to  major 
disasters  such  as  floods  and  hurricanes.  However,  it  is 
essential  to  remember  that  due  to  their  greater  frequency  of 
occurrence,  minor,  more  mundane  events  such  as  hardware 
and  software  failures,  and  operator  errors,  cause  far  greater 
disruption  of  service.  Contingency  planning,  if  it  is  to  be  ef- 
fective, should  include  the  means  to  prevent,  or  to  recover 
from,  minor  disruptions  as  well  as  catastrophic  situations. 

2.  Why  should  I  be  concerned  about 
contingency  planning? 

The  growing  dependence  during  the  past  two  decades  of  vir- 
tually all  Federal  agencies  on  ADP  resources  continues 
today  at  an  unprecedented  rate.  This  expanding  dependence 
increases  the  importance  of  plans  to  prevent  loss  of  ADP 
service  to  vital  agency  functions  and  activities. 

Until  very  recently  computers  were  widely  regarded  as 
simply  a  faster  and  more  cost  effective  means  of  performing 
already  established  manual  procedures.  Also,  when  a 
computer  failure  occurred,  it  was  possible  to  revert  to  the 
old  manual  processes  with  little  more  effect  on  the  organiza- 
tion than  inconvenience.  Today,  however,  the  computer 
must  be  considered  a  means  of  doing  what  cannot  otherwise 
be  done  without  it.  Further,  reverting  to  manual  processes 
upon  loss  of  the  ADP  resources,  for  whatever  reason,  is 
usually  not  practical  and  often  quite  impossible.  It  is 
critical  that  management  recognize  this  dependence  on  the 
ADP  resources  in  order  to  fully  appreciate  its  own  role  in 
contingency  planning.  The  plans  should  offer  adequate  as- 
surance that  any  reasonably  anticipatable  interruption  of  an 
ADP  facility's  services  will  not  preclude  the  continued 
execution  of  the  agency's  mission. 
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3.  What  role  should  management  have  in  the 
ADP  contingency  plan  development  process? 

The  key  ingredient  of  a  successful  ADP  contingency  plan  is 
support  of  the  plan  by  both  ADP  management  and  senior  or- 
ganizational management.  The  fact  that  support  by  ADP 
management  is  necessary  is  apparent;  the  requirement  for 
organizational  management  support,  though  perhaps  not  im- 
mediately obvious,  is  also  absolutely  essential.  The  primary 
reason  is  that  .^DP  services  are  essential  to  virtually  all 
echelons  of  the  organization.  Without  ADP  support,  many 
of  the  organizational  functions  cannot  be  performed.  Conse- 
quently, management  must  determine  the  critical  functions 
of  the  organization  and  the  interaction  and  relationships 
that  the  ADP  activity  has  with  each  of  these.  ADP  manage- 
ment must  not  be  placed  in  the  position  of  having  to 
determine  unilaterallv  which  functions  throughout  the  orga- 
nization are  critical  and  which  should  be  given  first  priority 
in  an  emergency.  This  is  a  responsibility  of  senior  manage- 
ment. In  summary,  management  should: 

•  Prior  to  the  preparation  of  an  .\DP  contingency  plan, 
direct  that  a  comprehensive  risk  analysis  be  accomplish- 
ed (See  11). 

•  Direct  that  all  affected  elements  of  the  organization 
participate  in  the  planning  process. 

•  Direct  the  periodic  comprehensive  testing  of  the  plan 
and  revision  as  necessary. 

4.  Who  prepares  the  ADP  contingency  plan? 

Responsibility  for  plan  preparation  should  be  in  the  data 
processing  activity.  Some  input  and  assistance  from  other 
activities  will  be  necessary,  but  the  overall  responsibility 
for  preparing,  maintaining  and  testing  the  plan  should  be 
assigned  to  the  data  processing  activity. 

5.  What  types  of  events  can  disrupt  the  ADP 
services  on  which  I  depend? 

Data  processing  services  are  susceptible  to  a  diverse  variety 
of  actions  which,  if  not  anticipated,  create  unwelcome  dis- 
ruptions and  unnecessary  expense  in  recovery.  A  brief,  non- 
exhaustive  list  includes  air  conditioning  failure,  power 
failure,  natural  disasters,  accidents  such  as  sprinkler  activa- 
tion and  Halon  discharge,  lost  or  destroyed  data,  forms  or 
other  supplies  unavailable,  strikes,  personnel  unavailable 
due  to  weather,  and  malicious  attacks  by  terrorists  or  dis- 
gruntled employees. 
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6.  Are  there  specific  government  directives  which 
require  contingency  plans  for  ADP  activities? 

Several  requirements  impact  contingency  planning,  both 
indirectly  and  specifically.  These  are: 

•  Public  Law  93-579  (Privacy  Act  of  1974),  Subsection 
3(e)(5)  requires  that  agencies  maintaining  systems  of 
records  subject  to  the  Privacy  Act  shall:  "maintain  ail 
records  .  .  .  with  such  accuracy,  relevance,  timeliness 
and  completeness  as  is  reasonably  necessary  .  .  ." 
Further,  subsection  (3)(e)(10)  stipulates  that  agencies 
shall:  "establish  appropriate  administrative,  technical, 
and  physical  safeguards  to  insure  the  security  and  confi- 
dentiality of  records  and  to  protect  against  any  antici- 
pated threats  or  hazards  to  their  security  or 
integrity  .  .  ." 

•  Federal  Property  Management  Regulations  (FPMR). 
The  General  Services  Administration  (GSA)  has 
published  comprehensive  requirements  for  ADP 
contingency  planning  in  41  CFR,  Chapter  101,  subparts 
101-35  and  101-36,  FPMR. 

•  Office  of  Management  and  Budget  (0MB)  Circular 
A-71,  Transmittal  Memorandum  Number  1,  July  27, 
1978  contains  a  wide  range  of  requirements  on  computer 
security,  including  contingency  planning.  In  particular,  it 
requires  that  each  agency  must  include  in  its  security 
program  policies  and  responsibilities  for  assuring  that  ap- 
propriate contingency  plans  are  developed,  tested  and 
maintained. 

7.  What  guidance  is  available  on  developing  a 
contingency  plan? 

Two  guidelines  published  by  the  National  Bureau  of 
Standards  are  particularly  relevant  to  contingency  planning: 
FIPS  PUB  31,  Guidelines  for  Automatic  Data  Processing 
Physical  Security  and  Risk  Management  [7j,  and  FIPS 
PUB  87.  Guidelines  for  ADP  Contingency  Planning  [6]. 
Other  sources  are  found  in  the  Bibliography. 

8.  How  does  contingency  planning  fit  into  the 
overall  ADP  security  program? 

A  successful  ADP  security  program  consists  of  a  number  of 
elements.  The  sum  total  of  all  elements  provides  a  synergis- 
tic effect  on  the  overall  security  program.  Contingency 
planning  is  but  one  of  these  elements;  others  are: 

•  Statement  of  security  policy  objectives 

•  Assignment  of  security  responsibilities 
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•    Definition  of  security  requirements 


•  Performance  of  risk  analyses 

•  Selection  and  implementation  of  safeguards  (adminis- 
trative, physical,  and  technical) 

•  Performance  of  periodic  audits  and  evaluations 

•  Security  considerations  during  ADP  system  develop- 
ment or  procurement,  to  include  quality  assurance,  con- 
figuration management  and  documentation  practices 

•  Personnel  hiring/termination  practices  and  training 

Many  functions  now  thought  of  as  belonging  to  ADP 
security  have  traditionally  been  categorized  as  a  part  of 
good  management.  Contingency  planning  is  certainly  one  of 
these,  as  prudent  managers  have  always  planned  for  the 
actions  to  be  taken  should  unexpected  events  occur.  Unfor- 
tunately, however,  the  ever  increasing  growth  in  dependen- 
ce on  the  ADP  resources  has  not  been  matched  by  a  corre- 
sponding growth  in  awareness  of  the  need  to  preserve  those 
vital  resources.  Actions  and  events  occurring  now,  however, 
make  it  increasingly  important  to  recognize  ADP  resources 
for  what  they  are,  i.e.,  a  vital  element  of  the  organizations 
which  they  support  and,  to  a  growing  extent,  one  without 
which  such  organizations  may  not  survive. 


DEVELOPING  THE  PLAN 

9.  Since  contingency  plans  should  be  developed  by 
all  Federal  .\DP  facilities,  can't  I  use  those 
developed  by  other  agencies  and  avoid 
duplication? 

Although  many  similarities  exist  among  ADP  facilities,  the 
disparities  in  equipment,  relative  criticality  of  functions, 
types  of  customers,  geographical  locations  and  other  factors 
tend  to  make  each  facility  unique.  This  uniqueness 
precludes  the  use  of  a  single  contingency  plan  by  more  than 
one  activity. 

10.  How  should  one  begin  developing 
a  contingency  plan? 

Two  things  are  essential  to  the  development  of  adequate, 
cost-effective,  and  workable  contingency  plans.  First,  the 
functions  supported  by  .ADP  which  are  critical  to  the 


5 


mission  of  the  parent  organization  must  be  identified. 
These  usually  represent  a  relatively  small  percentage  of  the 
total  ADP  workload.  Second,  the  resources  essential  to  the 
accomplishment  of  these  specific  functions  must  also  be 
identified.  A  formal  risk  analysis,  as  described  in  FIPS 
PUB  65,  Guideline  for  ADP  Risk  Analysis  [5],  or  other 
similar  methodologies,  will  provide  the  data  from  which 
identification  of  both  critical  functions  and  critical 
resources  can  be  derived.  Once  this  is  done,  preparation  of 
the  plan  may  be  begun  in  a  logical,  systematic  manner. 
Generally,  the  plan  is  developed  in  three  parts- Preliminary 
Planning,  Preparatory  Actions,  and  the  Action  Plan.  Each 
part  is  described  below  (See  13). 

11.  Who  performs  a  risk  analysis? 

A  risk  analysis  for  the  ADP  operation  should  generally  be 
accomplished  under  the  aegis  of  personnel  within  the  ADP 
activity,  quite  appropriately  with  the  advice  and  consent  of 
the  individual  assigned  the  responsibility  for  the  security  of 
the  installation  under  the  provisions  of  0MB  Circular  A-71, 
TM  No.  1.  Additionally,  it  is  essential  that  management 
direct  participation  by  other  organizational  activities  as 
required  to  support  the  process. 

12.  What  strategies  should  be  considered  in  ADP 
contingency  planning? 

In  order  to  develop  an  effective  plan,  those  charged  with 
doing  so  must  have  a  clear  understanding  of  what  the  goals 
are  before  commencing  preparation  of  the  plan.  To 
accomplish  this,  management  must  approve  of  a  number  of 
strategies  to  cover  a  variety  of  unexpected  and  unusual 
situations  which  might  occur  (Strategy  selection  is  included 
in  Preliminary  Planning  (See  13)).  For  example,  for  backup 
operations  the  approved  strategies  might  be  mutual  aid 
agreements,  no  backup  hardware,  use  of  commercial  contin- 
gency centers,  having  more  than  one  ADP  site,  etc. 

13.  What  are  the  critical  elements  of 
a  contingency  plan? 

It  is  difficult  to  categorize  any  one  element  or  part  of  a  con- 
tingency plan  as  being  more  important  than  another. 
Essentially,  each  part  of  the  plan  is  critical  and  must  be  ac- 
complished with  equal  diligence  for  the  plan  to  be  success- 
ful. The  three  major  parts  of  the  contingency  plan,  as 
specified  in  FIPS  PUB  87,  are: 

•  Preliminary  Planning  (Part  One).  This  part 
establishes  the  ground  rules  for  the  remainder  of  the 
plan,  i.e.,  it  describes  the  purpose,  scope  and  assump- 
tions relevant  to  the  plan.  It  also  assigns  responsibilities. 
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and  describes  the  organizational  strategry-  for  coping  with 
emergencies.  The  strategies  selected  will,  to  a  large 
extent,  directly  influence  the  development  and  amount  of 
detail  in  the  following  two  parts  of  the  plan. 

•  Preparatory  .Actions  (Part  Two).  This  part  contains 
sections  which  describe  how  the  organization  is  to 
respond  to  an  emergency.  For  example,  instructions 
should  be  developed  which  specify  how  to  maintain  the 
contents  of  off-site  storage,  how  to  form  backup  teams, 
how  to  determine  applications  and  system  software  re- 
quirements needed  for  different  situations,  and  how  to 
establish  communications  requirements.  This  part  of  the 
plan  is  prepared  in  as  much  detail  as  possible  since  it 
should  be  read  and  studied  beforehand  by  those  who 
ultimately  must  respond  to  an  emergency. 

•  Action  Plan  (Part  Three).  This  part  consists  of  three 
sections  which  document  what  to  do  when  an  emergency 
happens.  It  is  not  intended  to  be  a  tutorial,  but  should 
state  concisely  the  actions  necessar)'  to  effect  the  organi- 
zational strategies  which  were  selected  earlier  and  docu- 
mented in  part  one  of  the  plan.  The  three  sections  of  this 
part  are: 

Emergency  Response  Actions.  This  category 
includes  those  actions  which  employees  must  take  im- 
mediately upon  the  occurrence  of  an  emergency  to 
protect  lives  and  other  resources.  These  actions  are 
typically  necessary  upon  the  occurrence  of  major 
events  such  as  tornadoes,  floods,  fire  and  earthquakes, 
as  well  as  in  instances  of  more  common  happenings 
such  as  power  outages,  bursting  water  pipes,  etc. 

Backup  Operations  .Actions.  This  categor\-  includes 
those  actions  necessary  to  effect  temporary  operations 
at  an  alternate  location  when  operations  at  the  home 
facility  are  no  longer  possible  for  whatever  reason. 
These  may  entail  transportation  of  files,  office 
supplies,  equipment,  a  variety  of  other  materials,  and 
the  employees  to  the  alternate  site,  and  the  initiation 
of  ADP  operations  for  an  indeterminate  period  of 
time. 

-  Recovery  Actions.  This  section  should  describe 
what  must  be  done  to  restore  permanent  operations  at 
the  home  facility  following  a  disaster  or  major  disrup- 
tion of  service.  Included  may  be  plans  to  rebuild  the 
facility,  lease  alternate  facilities  and  equipment,  etc. 

14.    How  large  and  how  detailed  should  the 
typical  ADP  contingency  plan  be? 

The  value  of  a  plan  is  not  necessarily  proportional  to  its 
size.  The  indiscriminate  inclusion  of  material  of  doubtful 
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value  in  the  plan  will  seriously  downgrade  its  usefulness  to 
the  organization.  While  no  recommendation  is  made 
concerning  the  length  of  a  contingency  plan,  most  organiza- 
tions should  find  that  the  plan  will  fit  comfortably  in  a 
regular  loose-leaf  notebook.  Continuous  effort  will  be 
required  to  keep  the  plan  trim  and  concise,  yet  sufficiently 
detailed  to  communicate  the  relevant  information. 


OTHER  CONSIDERATIONS 

15.  What  effect  will  the  ADP  contingency  plan  have 
on  the  normal  day-to-day  operation? 

Generally,  little  effect  will  be  noticed.  During  development 
and  documentation  of  the  plan,  some  personnel  will  have  to 
be  diverted  from  their  routine  tasks  to  participate.  Careful 
testing  of  the  plan  should  cause  minimal  disruption.  For 
example,  to  test  the  backup  operations  actions,  the  needed 
backup  files  and  materials  would  be  taken  to  the  alternate 
site  for  processing  while  regular  operations  continue  at  the 
home  site.  Also,  to  test  emergency  response  actions  for 
fires,  bursting  pipes,  etc.,  it  is  not  necessary  to  cease  opera- 
tions. Frequently,  testing  can  be  accomplished  in  conjunc- 
tion with  other  regularly  scheduled  events,  e.g.,  if  the  ADP 
activity  closes  for  the  weekend,  emergency  power  down  pro- 
cedures can  be  tested  very  effectively  when  preparing  to 
shut  down  the  system  for  the  weekend. 

16.  My  ADP  support  is  furnished  by  a  service 
agency  (or  through  interagency  agreement). 
How  does  contingency  planning  affect  me? 

It  is  especially  important  to  consider  ADP  contingency 
planning  in  this  case.  Do  not  assume  that  the  ADP  activity 
(whether  Governmental  or  commercial)  which  normally 
provides  your  service  will  be  able  to  support  you  if  their 
ADP  operation  is  damaged  or  destroyed.  Quite  often,  emer- 
gency support  is  not  part  of  the  agreement;  consequently,  if 
ADP  support  is  necessary  to  the  successful  operation  of 
your  function,  you  must  initiate  the  action  to  ensvre  the 
availability  of  service  during  an  emergency.  If  a  responsive 
contingency  plan  is  not  extant,  and  emergency  support  is 
first  sought  when  needed,  days,  or  even  weeks,  may  be 
necessary  to  restore  a  semblance  of  normality  to  your 
activity.  Each  activity  that  receives  ADP  support  should 
develop  a  contingency  plan  to  address  all  aspects  of  emer- 
gency coverage,  and  the  plan  should  be  subjected  periodical- 
ly to  rigorous  testing  and  review.  A  key  point  to  remember 
is  that  even  though  day-to-day  ADP  support  from  a  service 
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agency  mav  be  outstanding,  it  cannot  be  assumed  that 
similar  serv  ice  will  be  available  if  the  servicing  activity  has 
an  emergency  situation. 

17.  My  ADP  equipment  is  part  of  a  distributed 
data  processing  (DDP)  network. 

How  does  contingency  planning  affect  me? 

Managers  of  DDP  nodes  should  consider  ADP  contingency 
planning  from  two  perspectives: 

•  As  a  stand-alone  entity  if  the  equipment  is  capable  of 
processing  applications  without  being  connected  to  the 
network.  For  this  situation,  contingency  planning  should 
be  essentiallv  the  same  as  that  for  a  large  computer 
center,  although  obviously  the  scope  may  be  smaller. 
Many  DDP  nodes  accomplish  considerable  stand-alone 
processing  which,  routinely,  may  include  ADP  systems 
that  are  critical  to  the  parent  organization. 

•  As  an  element  of  the  DDP  network.  The  contingency 
plan  should  reflect  the  degree  of  interaction  between  the 
node  and  other  computers  in  the  network,  and  include 
those  actions  necessary  to  be  effected  when  connections 
are  downgraded  or  severed.  Consider  eventualities  such 
as  one  or  more  communications  links  severed,  one  or 
more  of  the  other  nodes  down,  or  various  combinations 
of  both.  During  times  of  disruption,  some  processing  may 
have  to  be  postponed;  however,  quite  often,  it  is  possible 
to  operate  in  a  downgraded  (i.e.,  stand-alone)  mode  by 
batching  transactions  for  later  transmission.  Additionally, 
alternative  routing  through  other  than  normally  used 
communications  channels  may  be  possible,  thus  permit- 
ting continuation  of  normal  processing. 

18.  How  is  contingency  planning  related  to  the 
normal  .\DP  application  systems  design  process? 

If,  during  the  initiation,  requirements  definition,  and  design 
phases  of  systems  development,  recover)'  checkpoints  are 
specified  and  documented,  contingency  planning  will  un- 
doubtedly be  easier  to  accomplish.  For  example  for 
recovery  purposes,  during  the  course  of  normal  operations, 
files  must  be  periodically  dumped  for  transfer  to  the  alter- 
nate storage  site.  If  sufficient  recovery  checkpoints  are 
designated  at  the  very  beginning,  a  subsequent  retrofit  oper- 
ation in  the  documentation  and  procedures  can  be 
precluded.  Effective  systems  designers  and  analysts  know 
that  no  system  is  completely  fail-safe;  therefore,  they  will 
design  such  safeguards  and  procedures  into  their  systems  as 
will  facilitate  backup  and  recovery  operations  when  the 
need  arises. 
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